[17242] in Kerberos-V5-bugs
[krbdev.mit.edu #9272] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Nov 9 12:03:27 2026
From: "Greg Hudson via RT" <rt@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-3131886-1794243783-44.9272-5-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9272":;
Date: Mon, 09 Nov 2026 12:03:03 -0500
MIME-Version: 1.0
Reply-To: rt@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9272 >
Properly verify RPCSEC_GSS call arguments
In gssrpc__svcauth_gss(), use a new helper svcauth_gss_check_call()
for RPCSEC_GSS_DATA and RPCSEC_GSS_DESTROY() messages, subsuming the
existing sequence number checking and svcauth_gss_validate() calls.
In the helper, set gd->sec.svc to the verified service value
(typically RPCSEC_GSS_SVC_PRIVACY) from the current message, to be
used when unwrapping call arguments and wrapping return arguments.
Check the sequence number before the verifier, and check the verifier
before updating the sequence window.
In svcauth_gss_accept_sec_context(), do not record the unverified
service value.
Add an RPCSEC_GSS mode to the gssrpc unit-test client. In this mode,
make a call at each service level after establishing the context at
each level.
[ghudson@mit.edu: edited commit message; made minor style edits]
CVE-2026-118380:
In MIT krb5 release 1.4 and later, an active network attacker can
alter the arguments sent by a legitimate client to RPC services
protected by RPCSEC_GSS, or cause return values to be sent in plain
text.
(cherry picked from commit 2cda39a6c0a2ee19b7cdd811e07d564506388fe3)
https://github.com/krb5/krb5/commit/d6849c7c5fb388ba7f48d4d773bb940ecdbc993e
Author: Alejandro Pacheco <alepacheco99@gmail.com>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: d6849c7c5fb388ba7f48d4d773bb940ecdbc993e
Branch: krb5-1.22
src/lib/rpc/svc_auth_gss.c | 82 +++++++++++++++++++++++++++------------
src/lib/rpc/unit-test/client.c | 88 ++++++++++++++++++++++++++++++++++++++++--
src/lib/rpc/unit-test/t_rpc.py | 3 ++
3 files changed, 145 insertions(+), 28 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
